Colombia's e-signature framework rests on two main instruments: Law 527 of 1999 and Decree 2364 of 2012 (compiled into Decree 1074/2015, Art. 2.2.2.47.1 et seq.).

Law 527/1999 established the foundational rule that data messages and electronic signatures carry the same legal validity and enforceability as paper documents and handwritten signatures. A contract's validity isn't denied merely because it was formed through a data message. The law also introduced Colombia's original certificate-based Firma Digital, further regulated by Decree 1747 of 2000, which requires a certificate issued by a certification entity accredited by ONAC (Organismo Nacional de Acreditación de Colombia) and carries a stronger presumption of authenticity.

Decree 2364 of 2012 broadened this by formally defining Firma Electrónica as any technical mechanism, including codes, passwords, biometric data, or private cryptographic keys, that reliably identifies a signer and is appropriate to the purpose of the message, independent of ONAC certification. This gives Colombia a two-tier model, not the three-tier SES/AES/QES structure eIDAS uses: an unrestricted, technology-neutral Firma Electrónica tier that covers ordinary commercial use, and a certificate-based Firma Digital tier reserved for cases where a stronger presumption of authenticity is wanted or required.

Colombian courts have upheld this framework directly. The Constitutional Court (Judgment C-831 of 2001) held that courts and public entities may rely on electronic and telematic documents with the same validity as originals, provided their authenticity and integrity are guaranteed. The Supreme Court of Justice (judgment of December 16, 2010) set out a practical evidentiary test for data messages: completeness, inalterability since issuance, traceability, and preservability, a test Colombian courts still apply when weighing electronically signed evidence.

Named exclusions are narrower than boilerplate assumptions suggest, and real estate and wills aren't excluded document types under Law 527 itself. Both instead require an in-person notarial process regardless of signature technology. Real estate transfers, encumbrances, and any transaction requiring a public deed (escritura pública) must be executed before a notary under the Notarial Statute (Decreto 960 de 1970), and the same wet-ink requirement extends to civil trust agreements and civil society contracts. Decree 2106 of 2019 amended the Notarial Statute so the notary's own signature on the deed can now be electronic, but the underlying transaction still requires the notarial process rather than a standalone commercial e-signature platform. Wills (testamento abierto or cerrado) similarly require execution before a notary plus three to five witnesses in person under the Civil Code, so electronic signature only applies within that notarial process rather than as a substitute for it. Negotiable instruments, specifically bank checks, require a wet signature, and the Colombian government's obligations under international treaties are separately excluded under Law 527 itself.

Colombia's most significant recent development sits outside the e-signature statute proper. Ley 2213 de 2022 made permanent the pandemic-era rules (Decree 806/2020) enabling digital channels and data messages in judicial proceedings, and went further by letting parties grant special powers of attorney for judicial actions via data message with only a signature line: no signature, digital or handwritten, required at all, and no in-person recognition needed. Combined with Decree 2106/2019 letting notaries execute deeds electronically, Colombia has been steadily digitizing the processes around its e-signature law rather than rewriting the core two-tier structure Law 527 established in 1999.

For data protection, Colombia's Law 1581 of 2012 (Habeas Data) governs personal data as a constitutional right, enforced by the Superintendency of Industry and Commerce (SIC). It differs from GDPR in structure rather than closely mirroring it. Cross-border transfers are prohibited by default unless the receiving country meets an 'adequate' protection standard or a specific exception applies, such as consent, contract necessity, medical or banking exchange, or treaty. SIC Circular 003 of 2025 newly endorsed model contractual clauses from the Iberoamerican Network for Data Protection as a transfer mechanism for otherwise non-adequate destinations, the closest Colombia currently has to an SCC-style option. No EU-Colombia adequacy decision exists in either direction, so Firma.dev's EU hosting doesn't independently resolve the transfer question the way it might for a jurisdiction with a mutual adequacy finding.